fix GitHub Action (CI/CD) Vulnerabilities

Trello Ticket #115

Issue #47

Hardened GitHub Actions security by protecting secrets using enviroments and limiting workflow runs on protected branches.

CHALLENGE:

Problem:

Bad actors could inject malicious scripts into GitHub Actions. Workflows run on pull requests, so any custom GitHub Action steps could be run.

Action:

Fix #1:

[x] Add CODEOWNERS file, requiring a review by me before .github/workflow changes are added to main branch

Fix #2:

[x] Refactored GitHub Actions to correct Continuous Integration workflow. ONLY run building and testing, not publishing in this action.

Fix #3:

[x] Reconfigure GitHub Actions to use enviroments for ci and production
[x] Update EXAMPLE REPOSITORY secrets in resources/

GitHub secrets can be accessed in a GitHub actions. A bad actor could COPY the secrets values to a file, and then simply print the file contents. GitHub Actions prints out logs of the virtual machine, which can be viewed.

Fix #4:

BRANCH Refactor - protect the main production branch, and use development branch for features

Branch protection:

main branch =>

runs Continuous Integration + Delivery deploy.yml workflow

accesses enviroment: production secrets

cannot be deleted

cannot be force pushed

requires linear history

requirs PR review

requires status checks: strict (must be up to date and status checks pass)

Other Research

USING GIT FLOW: RND: Intro to git flow command - git flow cheatsheet Git flow usage example - Article

Step 1: Configure Git flow

$ git flow init
$ git branch -a
* development
main

Step 2: create feature branch

$ git flow feature start feature_branch
Switched to a new branch 'feature/feature_branch'
$ git add .
$ git commit -m 'made some changes'

Step 3: finish the feature, commit the changes

$ git flow feature finish feature_branch
Switched to branch 'development'
Updating 8fdc0d7..f2e257f
Fast-forward
feature.html | 0
1 file changed, 0 insertions(+), 0 deletions(-)
create mode 100644 feature.html
Deleted branch feature/feature_branch (was f2e257f).

spencerlepine / woofer